IN THE CLAIMS: 



Please AMEND claims 1 and 1 1-28, as shown below. 

1. (Currently Amended) A metho d for controlling transfer of data botwoon a 
s e rvic e provid e r and a us e r in a communication syst e m wher e the s e rvic e provider 
possess e s a privacy policy , the method comprising: 

introducing receiving te-a^a broker a usage policy for constraints related to data of 
a use r in a communication system : 

receiving a request for data associated with the user from a service provider in the 
communication system to the broke r, wherein the service provider possesses a privacy 
policy : 

checking, in the broker, the request against a usage policy of the user; and 
deciding whether the data can be released^ 

wherein the privacy policy and the usage policy specify a strictness level, selected 
from a defined seMist of strictness levels, describing the constraints related to the access 
of data. 

2. (Previously Presented) The method of claim 1, further comprising: 
using the user to define the usage policy for the constraints related to the data. 

3. (Previously Presented) The method of claim 1, further comprising: 
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providing the broker with a predefined set of privacy policies and usage policies. 

4. (Previously Presented) The method of claim 3, wherein the providing 
comprises providing the privacy policies and the usage policies comprising similar 
information elements. 

5. (Previously Presented) The method of claim 3, wherein the providing 
comprises providing at least one of the privacy policies and at least one of the usage 
policies which specify a strictness level describing the constraints related to the data. 

6. (Previously Presented) The method of claim 3, further comprising: 

using the user to choose the usage policies for the constraints related to the data. 

7. (Previously Presented) The method of claim 5, further comprising: 
releasing user data when the at least one of the privacy policies of the service 

provider matches with the specified strictness level of the at least one of the usage 
policies of the user. 

8. (Previously Presented) The method of claim 5, further comprising: 
indicating, by the broker, the strictness level of the at least one of the usage 

policies of the user to the service provider when the at least one of the privacy policies of 
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the service provider does not match with the specified strictness level of the at least one 
of the usage policies of the user. 

9. (Previously Presented) The method of claim 5, further comprising: 
allowing the user to reduce a usage policy requirement when the at least one of the 

privacy policies of the service provider does not match with the specified strictness level 
of the at least one of the usage policies of the user. 

10. (Previously Presented) The method of claim 1, further comprising: 
attaching an electronically signed usage policy to the data when the data is 

released. 

11. (Currently Amended) A data transfer system,, comprising: 
a service provider possessing a privacy policy; and 

a broker hosting a usage policy for constraints related to data of a user, configured 
to check a request from the service provider against the usage policy of the user and to 
decide whether data associated with the user can be released in response to the request- 

wherein the usage policy specify a strictness level selected from a defined list of 
strictness levels, describing the constraints related to the access of data . 

12. (Currently Amended) A data transfer system, comprising: 
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introducing means for introducing to a broker a usage policy for constraints related 
to data of a user; 

receiving means for receiving a request for data associated with the user from a 
service provider to the broker; 

checking means for checking, in the broker, the request against a usage policy of 
the user; and 

deciding means for deciding whether the data can be released; 
wherein the usage policy specifies a strictness level selected from a defined list of 
strictness levels, describing the constraints related to the access of data . 

13. (Currently Amended) A device, configured to A n apparatus, comprising : 

a receiver configured to receive a request for data associated with a user from a 
service provider; and 

a processor configured to check the request against a usage policy of the userf and 
to_decide whether the data can be released,, 

wherein the usage policy specifies a strictness level selected from a defined list of 
strictness levels, describing constraints related to the access of data . 
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14. (Currently Amended) The d e vic e apparatus of claim 13, wherein the 
processor is further configured to: 

release user data when at least one privacy policy of the service provider matches 
with a specified strictness level of the usage policy of the user. 

15. (Currently Amended) The device apparatus of claim 13, wherein the 
processor is further configured to: 

indicate the strictness level of the at least one of the usage policies of the user to 
the service provider when the at least one of the privacy policies of the service provider 
does not match with the specified strictness level of the at least one of the usage policies 
of the user. 

16. (Currently Amended) The deviee -apparatus of claim 13, wherein the 
processor is further configured to: 

allow the user to reduce a usage policy requirement when the at least one of the 
privacy policies of the service provider does not match with the specified strictness level 
of the at least one of the usage policies of the user. 

17. (Currently Amended) The deviee -apparatus of claim 13, wherein the 
processor is further configured to: 

attach an electronically signed usage policy to the data when the data is released. 
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18. (Currently Amended) A dovico A n apparatus , comprising: 

receiving means for receiving a request for data associated with a user from a 
service provider; 

checking means for checking the request against a usage policy of the user; and 
deciding means for deciding whether the data can be released; 
wherein the usage policy specifies a strictness level selected from a defined 
ordered list of strictness levels, describing the constraints related to the access of data . 

19. (Currently Amended) A computer-readable medium having comprising 
computer-executable components for controlling transfer of data b e tw ee n a s e rvic e 
provider and a user in a communication syst e m wh e r e th e s e rvice provider possesses a 
privacy policy , the components arranged fo r configured to : 

r e ceiving receive a usage policy for constraints related to data of a use r in a 
communication system : 

receiving receive a request for data associated with the user from a service 
provide r in the communication system, wherein the service provider possesses a privacy 
policy ; 

ch e cking check the request against a usage policy of the user; and 
d e ciding decide whether the data can be r e leas e d; released, 

wherein the privacy policy and the usage policy specify a strictness level, selected 
from a defined set-UsLof strictness levels, describing the constraints related to the access 
of data. 
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20. (Currently Amended) The medium of claim 19, wherein the components are 
arrang e d fo r configured to : 

permit the user d e fining t o define t he usage policy for the constraints related to the 

data. 

21. (Currently Amended) The medium of claim 19, wherein the components are 
arrang e d fo r configured to : 

r e c e iving receive a predefined set of privacy policies and usage policies. 

22. (Currently Amended) The medium of claim 21, wherein the-receiving the 
predefined set comprises receiving the privacy policies and the usage policies comprising 
similar information elements. 

23. (Currently Amended) The medium of claim 21, wherein the-receiving the 
predefined set comprises receiving at least one of the privacy policies and at least one of 
the usage policies which specify a strictness level describing the constraints related to the 
data. 

24. (Currently Amended) The medium of claim 21, wherein the components are 
arrang e d fo r configured to : 
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permit the user choosing to choose the usage policies for the constraints related to 
the data. 

25. (Currently Amended) The medium of claim 23 , wherein the components are 
arranged fo r configured to : 

rel e asing release user data when the at least one of the privacy policies of the 
service provider matches with the specified strictness level of the at least one of the usage 
policies of the user. 

26. (Currently Amended) The medium of claim 23, wherein the components are 
arrang e d fo r configured to : 

indicating indicate the strictness level of the at least one of the usage policies of 
the user to the service provider when the at least one of the privacy policies of the service 
provider does not match with the specified strictness level of the at least one of the usage 
policies of the user. 

27. (Currently Amended) The medium of claim 23, wherein the components are 
arranged fo r configured to : 

allowing allow the user to reduce a usage policy requirement when the at least one 
of the privacy policies of the service provider does not match with the specified strictness 
level of the at least one of the usage policies of the user. 
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28. (Currently Amended) The medium of claim 19, wherein the components are 
arranged fo r configured to : 

attaching attach an electronically signed usage policy to the data when the data is 
released. 
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